From: edison <daiwei521@126.com>
Date: Fri, 16 Jan 2026 09:39:50 +0000 (+0800)
Subject: fix(server-renderer): use ssrRenderClass helper for className attribute (#14327)
X-Git-Tag: v3.5.27~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a4708f324f62ac2122f87c4ee039deb2745f0905;p=thirdparty%2Fvuejs%2Fcore.git

fix(server-renderer): use ssrRenderClass helper for className attribute (#14327)

fix https://github.com/vuejs/core/security/advisories/GHSA-5c3j-59mh-x5gj
---

diff --git a/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts b/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts
index 984387bb86..e7332455db 100644
--- a/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts
+++ b/packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts
@@ -154,7 +154,7 @@ describe('ssr: renderClass', () => {
       ssrRenderAttrs({
         className: ['foo', 'bar'],
       }),
-    ).toBe(` class="foo,bar"`)
+    ).toBe(` class="foo bar"`)
   })
 })
 
diff --git a/packages/server-renderer/src/helpers/ssrRenderAttrs.ts b/packages/server-renderer/src/helpers/ssrRenderAttrs.ts
index b082da03fe..903a9c9b3d 100644
--- a/packages/server-renderer/src/helpers/ssrRenderAttrs.ts
+++ b/packages/server-renderer/src/helpers/ssrRenderAttrs.ts
@@ -38,12 +38,10 @@ export function ssrRenderAttrs(
       continue
     }
     const value = props[key]
-    if (key === 'class') {
+    if (key === 'class' || key === 'className') {
       ret += ` class="${ssrRenderClass(value)}"`
     } else if (key === 'style') {
       ret += ` style="${ssrRenderStyle(value)}"`
-    } else if (key === 'className') {
-      ret += ` class="${String(value)}"`
     } else {
       ret += ssrRenderDynamicAttr(key, value, tag)
     }